custom fonts on pdf; ticket system for CSRF elimination; and more

1 files changed, 64 insertions, 2 deletions

diff --git a/public/app/controllers/Office.php b/public/app/controllers/Office.php
index d4b0217..800247e 100644
--- a/public/app/controllers/Office.php
+++ b/public/app/controllers/Office.php
@@ -199,8 +199,13 @@ class Office {
             ['name' => 'user_id', 'value' => $user_id]      // pass user identity
         ]);
 
-        // #5: render the view -------------------------------------------------
-        Render::view('templates/application', ['form' => $form]);
+        // #5: create ticket; then render the view -----------------------------
+        $ticket = self::create_ticket($ticket);      // save ticket
+        Render::view('templates/application', [
+            'form' => $form,
+            'applier' => (($userData['prefix'] == 'η') ? 'Η Αιτούσα' : 'Ο Αιτών'),
+            'ticket' => $ticket
+        ]);
     }
 
 
@@ -255,6 +260,63 @@ class Office {
 
 
 
+
+    ## -------------------------------------------------------------------------
+    ##
+    ## TICKET METHODS (create, remove)
+    ## tickets eliminate CSRF attacks
+    ##
+    ## -------------------------------------------------------------------------
+
+
+    /** create_ticket
+     * 
+     * creates a tickef and saves it into session
+     * 
+     * @return string new ticket (MD5)
+     */
+    private static function create_ticket()
+    {
+        // create ticket
+        $tick = md5( time() . Auth::user_data() . rand(1,65536) );
+        // then save to session
+        if (isset($_SESSION['tickets'])) {
+            $tickets = explode(',', $_SESSION['tickets']);
+            $tickets[] = $tick;
+            $_SESSION['tickets'] = implode(',', $tickets);
+
+        } else {
+            $_SESSION['tickets'] = $tick;
+        }
+
+        return $tick;
+    }
+
+    /** remove_ticker
+     * 
+     * removes a ticket and return true;
+     * if ticket not exists return fase;
+     * 
+     * @param string $t : ticket (MD5)
+     * @return boolean
+     */
+    private static function remove_ticket($t)
+    {
+        if (isset($_SESSION['tickets'])) {
+            $tickets = explode(',', $_SESSION['tickets']);
+            if (($key = array_search($t, $tickets)) !== false) {
+                unset($tickets[$key]);
+                $_SESSION['tickets'] = implode(',', $tickets);
+                return true;
+            }
+        }
+        return false;
+    }
+
+
+
+
+
     ## -------------------------------------------------------------------------
     ##
     ## ADMIN METHODS (insert, updated etc.)